Add disable_cookies macro.

[wout]

Purpose

Implements #1178.

Description

When used, the Set-Cookie header will not be written to the response headers.

class Events::Show < ApiAction
  disable_cookies

  get "/events/:id" do
    ...
  end
end

Checklist

• - An issue already exists detailing the issue/or feature request that this PR fixes
• - All specs are formatted with crystal tool format spec src
• - Inline documentation has been added and/or updated
• - Lucky builds on docker with ./script/setup
• - All builds and specs pass on docker with ./script/test

[jwoertink]

This looks good. Does this let us disable cookies being set for asset calls? My guess is no since those skip the RouteHandler and run through the StaticFilesHandler..... So I guess the better question is, do we need to be able to disable cookies at that level?

[paulcsmith]

@jwoertink I think they are no longer set for assets at all since there is no longer a middleware. I think that is ok/expected since I can't think of a reason assets would need to have cookies sent right? I really don't know how this is typically handled in frameworks, but I'd imagine there is no reason to set them on assets and would just add extra bloat so I think we're good

[wout]

@jwoertink I had to look into it but I think cookies are not sent on requests for static assets. Here is an example:

$ curl -I 127.0.0.1:3001/assets/images/features/pulse.png
HTTP/1.1 200 OK
etag: W/"1591695350"
last-modified: Tue, 09 Jun 2020 09:35:50 GMT
content-type: image/png
content-length: 430020
connection: keep-alive
Date: Wed, 10 Jun 2020 15:37:47 GMT

Maybe that used to be the case before with the old SessionHandler, but now cookies are written right before the response body is printed. So I think you'll never get cookie headers for static files.

[paulcsmith]

Looking good! Just one minor suggestion that should help with potential inheritance issues

[jwoertink]

Sweet. Cool with me! 👍

[confact]

This looks like just want I need to build it. Something we should consider later is to maybe disable the cookie as default for the API actions in lucky_cli. But that is for later.

Good job @wout - Love you! :D

[paulcsmith]

Looks great! And thanks for verifying no cookies are sent for static files 👍